The Alarm API in Mozilla Firefox before 33.0 and Firefox ESR 31.x before 31.2 does not properly restrict toJSON calls, which allows remote attackers to bypass the Same Origin Policy via crafted API calls that access sensitive information within the JSON data of an alarm.
CVSS Details
- CVSS 3.1 Base Score: 7.5
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Centos_linux | — | Upgrade xulrunner-develUpgrade firefoxUpgrade xulrunner | Dec 1, 2016 | Oct 15, 2014 |
| Freebsd | — | Upgrade linux-firefoxUpgrade linux-seamonkeyUpgrade linux-thunderbirdUpgrade firefox-esrUpgrade libxulUpgrade thunderbirdUpgrade seamonkeyUpgrade firefox | Dec 10, 2025 | Oct 14, 2014 |
| Gentoo Linux | — | Upgrade dev-libs/nspr.Upgrade www-client/seamonkey-bin.Upgrade mail-client/thunderbird.Upgrade mail-client/thunderbird-bin.Upgrade www-client/firefox.Upgrade www-client/seamonkey.Upgrade www-client/firefox-bin. | Oct 30, 2017 | Oct 15, 2014 |
| Mfsa2014 82 | — | Upgrade to the latest version of Mozilla FirefoxUpgrade to Mozilla Firefox ESR version 31.2Upgrade to Mozilla Firefox version 33.0 | Oct 16, 2014 | Oct 14, 2014 |
| Oracle Solaris | — | Upgrade web/data/firefox-bookmarks to version 31.6.0-0.175.2.11.0.3.0 on Solaris 11.2Upgrade consolidation/desktop/desktop-incorporation to version 0.5.11-0.175.3.0.0.28.0 on Solaris 11.3Upgrade web/browser/firefox/multi-user-desktop to version 31.6.0-0.175.2.11.0.3.0 on Solaris 11.2Upgrade web/browser/firefox to version 31.6.0-0.175.2.11.0.3.0 on Solaris 11.2 | May 29, 2017 | Oct 15, 2014 |
| Oracle_linux | — | Upgrade xulrunner-develUpgrade firefoxUpgrade xulrunner | Oct 16, 2024 | Oct 15, 2014 |
| Suse | — | Upgrade mozilla-nspr-develUpgrade mozilla-nss-x86Upgrade mozilla-nspr-32bitUpgrade MozillaFirefoxUpgrade libsoftokn3-x86Upgrade MozillaFirefox-translations-commonUpgrade libsoftokn3-32bitUpgrade mozilla-nss-develUpgrade mozilla-nss-32bitUpgrade libfreebl3-32bitUpgrade mozilla-nsprUpgrade MozillaFirefox-translationsUpgrade mozilla-nspr-x86Upgrade libfreebl3-hmacUpgrade mozillafirefox-branding-sleUpgrade mozilla-nssUpgrade libsoftokn3Upgrade mozilla-nss-certsUpgrade mozilla-nss-toolsUpgrade libfreebl3-x86Upgrade MozillaFirefox-translations-otherUpgrade libsoftokn3-hmac-32bitUpgrade mozilla-nss-certs-32bitUpgrade MozillaFirefox-develUpgrade libsoftokn3-hmacUpgrade libfreebl3Upgrade MozillaFirefox-branding-SLEDUpgrade libfreebl3-hmac-32bit | Dec 18, 2015 | Oct 15, 2014 |
| Ubuntu | — | Upgrade firefox | Nov 8, 2024 | Oct 15, 2014 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub